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ABSTRACT 


Digital forensics is a multidisciplinary field encompassing both computer science and criminal justice. 
This action research compared the demonstrated skill levels of students enrolled in a semester course 
in small device forensics with an 18-hour unit on NAND memory chip extraction and analysis (chip- 
off forensics) against the skill levels of industry professionals after completing a 40-hour workshop 
on chip-off forensics. Participant backgrounds were also examined to determine if those students 
with a background in computer science had an advantage over students with a criminal justice 
background. Study participants were volunteers ranging in age from 20 to over 60 and had a variety 
of backgrounds and prior work experience. Volunteers completed a timed trial comprised of four 
timed subtasks. Results were compared for both quality and speed in task. Qualitative, quantitative, 
and observational data were gathered throughout the course of this study. Data was analyzed 
through the use of graphs and tables. 


Keywords: digital forensics, digital forensics education, small device forensics, chip-off extraction 


1. INTRODUCTION residing in computer file systems and operating 


systems. The sub discipline of small devices or 
Digital forensics is a relatively new field in mobile forensics, however, has not yet settled 
academia. As collegiate computer forensics into- a. standard format. New models of cell 
courses emerge and develop, it is important that phones and tablets are released onto the market 
the institutes of higher learning evaluate these monthly. Each new model often stores data in a 


courses and the procedures taught therein. The yew and proprietary manner, frustrating the 
field of digital forensics has developed standards automated forensic tools designed to extract 


for the handling and processing of artifacts 
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said data (Casey, Bann, & Doyle, 2010). Other 
obstacles to small device forensics 
security damaged devices, 
damaged /disabled data ports, and encryption. 


includes 
locks, 


Solutions to small device forensics include 
automated and manual processes (McCarthy, 
2005). Automated processes include forensic 
software suites that simply require an examiner 
to connect a device and press a button, thereby 
earning the term, "push-button forensics." 
These suites are rarely customizable and require 
little interaction between the end user and the 
end results. The use of such equipment is the 
focus of many small device forensic certification 
courses. 


Cell phone and other personal electronic 
devices utilize a wide variety of file systems, 
operating systems, and artifact formats. At 
present. cell phones are typically examined live 
(Al-Zarouni, 2006). Forensic software suites 
require a cell phone to be booted in order for 
forensic software to extract data. The software 
sends commands to the device and the operating 
system on the device responds by sending data 
to the forensic workstation. Each model of 
phone must be individually programmed into 
each software suite: thus. these software suites 
support a limited percentage of consumer 
devices. In addition, data extracted from the cell 
phone is limited to data to which the phone’s 
operating system permits access. A need exists 
for processes that will allow forensic 
examination of problem cell phones and 
personal electronics (McCarthy, 2005). Chip-off 
forensics bypasses the cell phone’s operating 
system and copies all data bit for bit post 
mortem. 


The resulting bit-for-bit image needs to be 
parsed for evidentiary data. This can be done 
using automated tools, or the examiner may do 
this manually. When done manually (without 
pre-packaged, automated tools), the examiner 
must display a higher skill level to identify and 
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extract data. Due to this, manual parsing can 
be time intensive. 


The goal of this study is to evaluate the 54 
hours of a semester course in small device 
forensics with a physical extraction emphasis. 
The resulting skill levels of a sampling of 
students in this course will then be compared to 
the resulting skill levels of forensic professionals 
having completed an accelerated 40-hour 
training covering similar materials. Chip-off 
forensics is a unique skill to teach in an 
undergraduate setting. 


Interest in the chip-off process is high among 
forensic examiners whose automated forensic 
tools are not meeting their needs. Phones not 
supported by automated tools include pattern- 
locked Androids, password protected 
Blackberries, as well as TracFones and other 
pay-as-you-go phones with provider disabled 
data-ports (Hoog, 2011). These last phones are 
so prevalent with those who commit crimes that 
they are known as “burner phones” by law 
enforcement, indicating they are disposable 
phones purchased with the sole purpose of 
aiding in crime. 


It is interesting to note the subject 
university’s approach to digital forensics; many 
colleges /universities in the United States teach 
computer forensics in association with a 
Computer Science or Information Technology 
department. The subject university teaches its 
computer forensics emphasis as part of a 
criminal justice bachelor’s degree (digital 
forensics emphasis). Students from the 
Computer Science and IT departments are 
invited and encouraged to take digital forensic 
courses as electives, and also have the option of 
adding the digital forensic minor to their 
technical degree, but the overall viewpoint 
expressed is that of criminal justice over 
computer science, 


From time to time, this sparks debate as to 
who is better prepared coming into the program, 
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Thus, also reviewed in this action research will 
be the overall performance of students with a 
criminal justice background as compared to 
those with an IT or computer science 
background. The analysis of a binary image or 
hex dump is analysis at such a low level 
(meaning the data is close to the machine 
language and far from the human readable user 
interface) that it is not taught in the general 
instruction of computer science or information 
technology. Therefore, concern is expressed 
regarding prior levels of technological 
proficiency needed for students to develop 
proficiency in low level analysis at the 
undergraduate level. 


2. THE PROBLEM 


New students are quick to jump on the 
bandwagon of each new technique but can 
become easily overwhelmed when results require 
more than pushing the next button on a forensic 
solution software suite. Older professionals 
struggle to believe the more advanced 
techniques are possible outside of the national 
FBI lab or a well-funded research facility, and 
therefore discuss such techniques as one would 
an urban legend. This is particularly noticeable 
in the technique known as chip-off forensics. In 
chip-off, a small ball grid array (BGA) flash 
memory chip is removed from the printed circuit 
board (PCB). The chip is placed in a reader, 
which allows for a computer to extract a bit-for- 
bit copy of the binary information contained on 
the chip. The binary dump is then examined, 
researched and parsed for text messages, 
pictures, contacts, and other user-inputted data 
(Hoog, 2011). 


A need exists for more examiners, more and 
better-funded laboratories and more advanced 
techniques (Houck, 2006). Law enforcement 
agents report that backlogs at the FBI 
sponsored Regional Computer Forensic Labs 
cause waiting lists lasting six to twelve months 
(Matthews, 2013). 
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Far worse than the backlog existing in 
digital forensic laboratories, is the inability of 
these laboratories to process specific items of 
evidence. The chip-off process, long maligned in 
the United States as being expensive and time 
consuming, requires another look if only because 
of the example set by the Netherlands and 
England. Students and 
professionals trained in this technique become 
an asset to the workforce. Further research into 
streamlining the technique and developing more 
cost-effective equipment is also warranted. 


law enforcement 


Students equipped with a practical working 
knowledge of these techniques are also prepared 
to research and create needed equipment and 
processes. 


3. RESEARCH 
METHODOLOGY 


Both qualitative and quantitative methods were 
used in this study. Qualitative methods included 
an observation journal and student 
questionnaires including objective questions and 
questions with a Likert Scale type rating. 
Quantitative methods included evaluations of 
mock case analysis, timed tasks as well as end 
of term grades. The use of multiple data 
collection tools was implemented in an effort to 
paint a clearer picture of the efficacy of the chip- 
off training, and the prior knowledge 
recommended to successfully acquire this skill. 
The two primary research questions were: 


1. Do students with a computer science /IT 
background have a higher success rate 
than criminal justice majors when 
learning the chip off process? 

2. Do students in the 40-hour intensive 
training workshops have a higher success 
rate when learning the chip-off 
procedure than those who complete an 
18-hour chip-off unit in a 3-credit 
semester course in small device 
forensics? 
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4. HYPOTHESES 


Students completing 54 hours in mobile forensic 
physical processes throughout a _ three-credit 
hour semester course in small device forensics 
will have skill levels within a 10% variance of 
industry professionals trained on similar 
materials through a 40-hour workshop as 
determined by time completion and scoring of a 
chip-off trial. Participants with a computer 
science/IT background have a technical 
advantage and will therefore attain a 20% or 
higher performance level than those participants 
with criminal justice /non-technical 
backgrounds as determined by time completion 
time and scoring of a chip-off trial. 


5. RESEARCH DESIGN 


This study was a mixed method action research 
designed to assess differences in skill levels 
attained through a unit in a traditional on 
campus course versus an intensive 40-hour 
workshop. Both quantitative and qualitative 
data were collected to assess not only each 
participant adeptness at the skill at hand, but 
to gather information regarding attitudes and 
self-confidence regarding the task in question. 


Participants were members of two separate 
cohorts, a workshop cohort and a campus 
cohort. The workshop cohort was comprised of 
five students, all with law enforcement 
experience. Four of the workshop participants 
were male, and one was female. Three of the five 
students in the workshop cohort had bachelor’s 
degrees prior to chip-off training. 


The campus cohort was comprised of four 
undergraduate students enrolled in the criminal 
justice bachelor’s degree program with a digital 
forensics emphasis or in the computer science 
bachelor’s degree program. Two of the four 
students in the campus cohort had earned 
bachelor’s degrees prior to chip-off training. 
Three of the campus participants were male, 
and one was female. 
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6. EVALUATION 
METHODS AND 
‘TOOLS 


Each participant was given a factory reset 
(blank) Samsung SCH-U450 cell phone. 
Participants were asked to enter text messages 
and contacts into the phone. They were also 
asked to use the phone to snap random 
photographs. With known content added to the 
phones, participants were prepared to begin the 
chip-off process. Participants were timed as they 
completed the following sub-tasks: 


1. Remove the BGA chip from the PCB 
(de-solder) 

2. Place chip in reader/programmer and 
successfully read (extract binary image) 

3. Carve SMS /Pictures/Contacts 
(Participant choice of Scalpel, FTK 

and/or Cellebrite Physical 
Most student used a 
combination of the three.) 

4. Create a 2-page minimal report that 
documented three SMS, three contacts, 
and five pictures. 


Imager, 
Analyzer. 


Research data was gathered from the 
following six different sources: 


e Qualitative Data: This data included 
first-hand observation of the researcher 
and feedback from students. 

e Observation Journal: The researcher 
completed a journal entry after each 
instructional unit/classroom unit. 
Questions asked by students, anecdotal 
remarks on common or uncommon 
errors, failed tasks, and frustration level 
of students were noted in journal entries. 

e Student Questionnaire: Prior to 

students were asked to 

complete a student questionnaire 
detailing prior experience, computer 


instruction, 


training, level of education, age, sex, 


© 2017 ADFSL 


Varying Instructional Approaches to Physical ... 


race, interest in the field of digital 
forensics, and expectations of the course. 

e Student Completion Survey: Post- 
instruction, students with employment 
in a forensic lab setting were asked to 
complete a Likert Scale survey asking 
them to rate their training, their 
perceived level of expertise, and their 
opportunity to utilize their training. 
Anecdotal also 
requested. 


information was 

e Mock Case Analysis 
Participating students were asked to 
work a mock case. Students received 
points for successfully removing a BGA 
chip from a PCB board, inserting the 
BGA chip into a programmer/reader, 
extracting a viable binary image, and 
effectively translating data within a 
binary image into a human readable 
form appropriate for the court system. 
In addition, students recorded the 
amount of time required for each task. 

e End-of-Term Grades: Students in the 
Campus Course received an end-of-term 
grade. These grades were compared to 
student responses on the Student 
Questionnaire and analyzed for notable 
differences between students with a 


criminal justice background and 
students with a computer science 
background. 


The mock case was a timed performance 
assessment that returned qualitative data. In 
theory, a shorter performance time indicated 
confidence in and understanding of the acquired 
chip-off skills. The performance assessment was 
subdivided into four separate tasks. Each task 
was graded as pass/fail. The number of 
successfully completed tasks was compared to 
student demographic information as well as 
cohort to produce a percentage of each 
cohort /demographic who successfully complete 
each task. 
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7. RELIABILITY AND 
VALIDITY. 


Chip-off forensics is a relatively new field and as 
such, only a small pool of qualified participants 
exists. Timed trials were included in this study 
as a way to ensure repeatability. Course 
materials were beta tested in Thailand with 
participants from the Royal Thai Police and the 
Thai Electronic ‘Transaction Development 
Agency. Beta testing students included those 
with criminal justice backgrounds and those 
with computer science backgrounds. Feedback 
was given regarding course materials and 
individual tasks. 


Course material was reviewed by two 
subject matter experts for accuracy and task 
appropriateness. Subject matter experts used 
the course materials to conduct training for two 
workshops and one on campus course before 
testing was approved. Course material adjusted 
according to feedback from the subject matter 
experts included changing the sequence material 
was presented. 


While the subject cohorts matched 
somewhat in education and gender, no attempt 
was made to choose participants. Participants 
included one complete class of Chip-Off Forensic 
with 
backgrounds and random volunteers from an 


Training enrollees law enforcement 
undergraduate semester course in small device 


forensics. 


8. DATA DRIVEN 
FINDING SUMMARY 


The data gathered did not fully support the 
hypothesis. The resulting points from the chip- 
off timed trial displayed a significant difference 
(25%) between the campus cohort and the 
workshop cohort (Table 1 and Table 2). In 
addition, the workshop cohort reached 100% 
completion of all tasks, whereas only two of the 
four students (50%) in the campus cohort 
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successfully completed all tasks. One student 
was unable to retrieve photographs, while 


Table 1 
Campus Cohort Timed Trial Results 


Remove BGA Extract Binary Carve Data 


12 min 09 min 106 min 


12 min 22 min 145 min 


22 min 10 min 104 min 


10 min n/a n/a 


Times of students are listed in no particular order 


Table 2 
Workshop Cohort Timed Trial Results 


Remove BGA Extract Binary 


01 min 01 min K0 min 


04 min 20 min 100 min 


03 min 09 min aS min 


01 min 01 min 120 min 


02 min 30 min 00 min 


Carve Data 
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another student’s chip was damaged in the chip- 
off process and therefore no data was extracted. 


Create Report Total Time Points 


19 min 125 min 


34 min 179 min 


24 min 128 min 


n/a 180 


Create Report Total Time Points 


10 min 62 min 


16 min 150 min 


20 min 120 min 


18 min 240 min 


18 min 140 min 


Times of students are listed in no particular order 


The average time taken to complete the task 
was nearly 7% higher for the campus cohort 
(Table 1 and Table 2). The workshop cohort 
had a participant who was able to complete the 
entire task in just over 60 minutes, whereas the 
campus cohort had one participant who spent 
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three hours trying to unsuccessfully repair a 
chip. When these two extremes are removed, the 
campus cohort shows a completion time 11% 
faster than that of the workshop cohort. Which 
lends data to support the research hypothesis. 
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Fifty percent of the participants in the 
campus cohort had IT/computer science 
backgrounds and 50% had criminal justice 
backgrounds. Those with a computer science 
background performed better than those with a 
criminal justice background. The IT/computer 
science students averaged of 45 points as 
compared to the average of 35 points earned by 
the criminal justice students or an increase of 
22%. The criminal justice students averaged a 
total time of 154 minutes compared to 152 
minutes averaged by the computer science 
students of an increase of 1%. 


No comparisons could be made of the 
workshop cohort as none of the participants had 
an original background in computer science or 
IT. All had received training in digital forensics 
after pursuing a career in law enforcement. Each 
had received a bachelor’s degree in fields as 
varied as English, psychology, behavioral 
and biology. of the 
participants pursued training in computer 


science, Four five 
science after the opportunity to work in digital 


forensics presented itself. 


To enhance the timed trial data gathered 
regarding background training and its influence 
on the learning of digital forensics in general and 
chip-off forensics specifically, a survey was made 
of the associated small device forensics course in 
which 18 hours of chip-off training was 
presented. The class consisted of 18 students, 17 
of whom completed the class. Of the 17 
completing students, seven identified 
themselves as IT /computer science majors. The 
remaining ten students were identified as 
criminal justice students. The average grade for 
the computer science students was 87.3% with 
a range of 93.2% to 79.8%. The average grade 
for the criminal justice students was 86.2% with 
a range of 97.6% to 73.2%. 


9. DATA ANALYSIS 


At individual tasks, the workshop cohort 
worked at a quicker pace, with the BGA chip 
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removal displaying the greatest variance. The 
workshop cohort’s average removal time was 2.2 
minutes with a mean of one minute and a range 
of one to 4 minutes. The campus cohort’s 
average removal time was 14 minutes with a 
mean of 12 minutes and a range of 10 to 14 
minutes. This represents an 84% increase in 
time over the workshop cohort. 


It is important to note here that the 
Samsung SCH-U450 contains a small 138MB 
NAND Memory chip. This chip, in all cases, was 
removed by heat not to exceed 480 degrees 
Fahrenheit. Heat was applied from below with 
a ceramic plate and from above with high 
intensity lamp. Data is currently being gathered 
for additional research on eMMC chips. 


The extraction of the binary dump 
displayed the least degree of variance. The 
workshop cohort averaged 12.2 minutes at this 
task, with a range of 1 to 30 minutes. The 
campus cohort averaged 13.7 minutes at this 
task, with a range of 9 to 22. This is based on 
three trials, as on chip was not successfully read. 
The percentage of change between the workshop 
cohort and the campus cohort in this instance is 
10%. 


A 24% difference in time was noted between 
the time required for the workshop cohort to 
carve evidentiary data and the time required for 
the campus cohort. The workshop cohort 
averaged 89.6 minutes with a range of 50 
minutes to 120 minutes. The campus cohort 
averaged 118.3 minutes with a range of 104 to 
145 minutes. 


A 36% difference in time was noted between 
the time required for the workshop cohort to 
write a report detailing the discovered data and 
the time required for the campus cohort. The 
workshop cohort averaged 16.4 minutes with a 
range of 10 minutes to 20 minutes. The campus 
cohort average 25.7 minutes with a range of 19 
minutes to 34 minutes. 


Page 35 


JDFSL V12N4 


From this data it is appears that skills 
developed through professional work in other 
digital forensic tasks is transferrable to the chip- 
off forensic process. Teacher observation noted 
a celebratory tone throughout the workshop 
cohort’s chip-off trial. Participants appeared 
eager to show off what they had learned. The 
40-hour chip-off training provided participants 
with the opportunity to perform a complete 
chip-off of three to four phones. While several 
verbal comments were heard expressing a desire 
for more hands-on chip-off practice throughout 
the course, none of the participants expressed 
this as a response to the post-survey question: 
What suggestions would make for 
improving this course? Responses to this 
question included: 


you 


I would like to see more time on Scalpel and 
Strings, since many of the phones I deal with 
are Tracfones 

A bit more info on carving options 

More time on repairing phones 


The following are workshop cohort 
responses to the question: What did you like 
about chip-off training? 


So much hands on limited 
PowerPoints 

Doing the chip-off and repair of phones 
Loved the hands on, pulling the chaps in 
[illegible] and it was great to be able to pull 


multiple 


very 


Workshop cohort participants completed 
the chip-off task on the last day of the 40-hour 
training. As it was the final activity, 
participants were free to leave once the task was 
complete. This may have contributed to the 
celebratory mood of the test. Campus cohort 
participants. on the other hand, scheduled a 
time to complete the trial. Students worked 
individually, with only two trials overlapping in 
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time. Teacher journal entries noted signs of both 
stress and frustration. 


Students in the cohort had 
completed one in-class chip-off procedure prior 
to participating in the timed trial. Many 
expressed both verbally and in writing the desire 
for more hands-on training and application. The 
following are campus cohort responses to the 
question: What suggestions would you make for 
improving this course? 


campus 


More hands-on training, use more time on 
all tools that are available. 

More understanding on what to do, which 
tool, how to search, ete. 

Demonstration of BGA repair 

I think the course is great as is 


The following are workshop cohort 
responses to the question: What did you like 
about chip-off training? 


Hands-on! I was able to open up phone and 
analyze the interior parts 

That it is a very unique procedure that not 
many people know about 

State of the art technology 


Data gathered from the Student 
Completion Survey indicated 13% difference 
between confidence felt by those attending the 
attending the workshop cohort and the campus 
cohort (Table 3 and Table 4). On a Likert scale, 
participants rated their confidence on seven 
areas of small device forensic tasks, including 
the four tasks of the chip-off trial. After the 
trial, participants in the workshop cohort 
averaged a 3.7 on a scale that listed 4 as ‘very 
confident’ and 1 as ‘extremely unsure.” On the 
same scale, students in the campus cohort 
average a 3.2, indicating ‘somewhat confident.’ 
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Table 3 
Student Questionnaire Campus Cohort 


Strongly Strongly 


Disagree Disagree Agree Agree 


[| am comfortable working with 


computers and technology 4 students 


I would like to work with comput- 


ers and technology in the future 4 students 


I would like to work in a forensics 


field in the future 4 students 


I am comfortable with my 
knowledge of the law and the 4 students 
court system 


I would like to work in the court 


system in the future. l student 3 students 
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Table 4 
Student Questionnaire Workshop Cohort 


Strongly 


Disagree 


I am comfortable working with computers 


and technology 


I would like to work with computers and 


technology in the future 


I would like to work in a forensics field in 


the future 


I am comfortable with my knowledge of 


the law and the court system 


I would like to work in the court system 


in the future. 


Student responses are in no particular order 


Prior to the training, students indicated 
their comfort level with computers and with 
criminal justice topics. All students in the 
workshop cohort and the campus cohort agreed 
or strongly agreed that they are comfortable 
working with computers. Students in both 
cohorts disagreed with the statement that they 
like or would like to work with the US court 
system (Table 3 and Table 4). 


10. ANSWERS TO THE 
RESEARCH 
QUESTIONS 


Do students with a computer science/IT 
background have a higher success rate than 
criminal justice majors when learning the chip 
off process? 


Success at digital forensics in general and 
the chip-off process in particular did not appear 
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Strongly 
Disagree Apree Apree 


1 student 4 students 


5 students 


5 students 


5 students 


2 students 3 students 


to be dependent upon knowledge in a specific 
background field. While in the campus cohort 
students with a computer science background 
performed at a slightly higher level (87.3% to 
86.2), the 1.1% is a minimal distinction. Kessler 
and Shirling (2006) assert that digital forensics 
requires skills from both the field of criminal 
justice and computer science. Data gathered 
from this study indicates that neither field is 
more important than the other. Data gathered 
from the workshop cohort would indicate that 
skills in digital forensics and chip-off procedures 
can be learned regardless of preliminary 
undergraduate studies. 


Do students in the 40-hour intensive 
training workshops have a higher success rate 
when learning the chip-off procedure than those 
who complete an 18-hour in a 3-credit semester 
course in small device forensics? 
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A higher success rate was achieved by 
students participating in a 40-hour training 
workshop over students completing the 3-credit 
semester course in small device forensics. This 
in part can be attributed to the additional time 
for hands-on learning, but in part it should also 
be noted that participants in the 40-hour 
training workshop were able to apply skills 
gained from prior digital forensic experience 
toward the chip-off procedural tasks. 


11. FINDINGS 
SUMMARY 


It was hypothesized that students completing 
the three-credit hour semester course in small 
device forensics will have skill levels within a 
10% variance of industry professionals trained 
through a 40-hour workshop in the chip-off 
procedure as determined by completion time 
and scoring of a chip-off trial. Participants with 
a computer science/IT background have a 
technical advantage and will therefore attain a 
20% or higher performance level than those 
participants with criminal justice/non-technical 
backgrounds as determined by time completion 
time and scoring of a chip-off trial. 


Data gathered by this research study 
indicated that while students in the campus 
cohort were able to complete the subject trial 
within a 10% variance of those in the workshop 
cohort, the quality of the tasks completed was 
not within the 10% variance. Workshop cohort 
members earned 25% more points than those in 
the campus cohort. 


Participants with a computer science/IT 
background did not attain a 20% or higher 
performance level than those participants with 
non-technical backgrounds. No data could be 
gathered in this area from the chip-off trial. 
Grade comparisons from the small device 
forensics semester course indicated a 1.1% final 
grade difference between students with a 
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computer science background and those with a 
criminal justice background. 


12. IMPLICATIONS 


The assertion has been made that the chip-off 
process, while effective, is too costly and highly 
skilled to be a viable solution to data extraction 
from problem small devices. In this study, both 
students receiving forty hours of instruction and 
students receiving eighteen hours of instruction 
were able to successfully remove a BGA chip 
from a PCB board, place the BGA chip in a 
reader/programmer to extract a binary image, 
parse the image for data, and include the carved 
data in a suitable report. 


The rework station used to remove the chip 
was a T862 IRDA infrared heating rework 
station retailing for just over $300. While this 
machine is not as precise as the $30,000 German 
rework station utilized by the university’s 
digital forensics lab, it was able to effectively 
work on the Samsung SCH-U450’s employed by 
this study. The reader/programmer used for 
this study was the Up&Up 818, which retails for 
under $1,000 as does the required A110 adapter. 
The total cost of equipment used for this trial 
was just over $2,000. 


It needs be stated that the T862 IRDA is 
not recommended for newer phones, as it does 
not regulate chip temperature. Chips heated to 
over 350 degrees Celsius risk irreparable damage 
to data stored on the chip. The university 
associated with this study is currently in the 
process of developing a chip-off device with 
regulatory features that will cost under $5,000. 
The implications of this study demonstrate that 
the chip-off process is both an affordable process 
and a skill that can be reasonably acquired. 


13. LIMITATIONS 


The limitations of this study are manifest in the 
unique nature of the subject matter. As few 
people in the United States are practicing or 
studying the process of chip-off forensics, it was 
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not possible to perform this study with largeness 
of population or randomness in selection. In 
addition, few to no studies have been made 
regarding this area. Thus, a norm could not be 
established, nor a comparison made to other 
work. 


In addition, this study was completed with 
a very small pool of participants. Digital 
forensics is a relatively new field of university 
study. The chip-off forensics procedure is a 
cutting-edge procedure currently only practiced 
at a handful of labs inside the United States. 
Studies into effective methods of teaching this 
procedure were not found. No norm, therefore, 
could be established, as the body of research 
into this subject was at the time non-existent. 


14. RECOMMENDATIONS 


Additional research is recommended in the field 
of digital forensics instruction. Instruction at 
the primary and secondary level is highly 
researched. Teachers at the primary and 
secondary level are trained in pedagogy and 
instructional practices. Instructors and 
professors at the college and university level are 
not required to complete any pedagogy courses 
and therefore often rely on research done at the 


secondary level to determine best practices. 


Fields of study taught solely at a 
college/university level, therefore, are 
sometimes lacking in development of 


pedagogical research and instructional design. 


A fear exists that the forensic sciences are 
fad driven and a result of a CSI Effect, a 
national sudden interest in the use of science to 
solve crimes as depicted on highly popular 
television dramas such as the successful CSI 
franchise, Bones, Body of Evidence, and Law 
and Order. The increase of digital forensics 
programs at the college and university level 
appears to be driven by a public demand under 
the influence of the CSI Effect (Mardis, 2006). 
It is the responsibility of colleges and 
universities offering digital forensic programs to 
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design instruction that offers subjects and 
training that include sound scientific techniques 
and meet the spirit and letter of the law. 


15. FURTHER 
INVESTIGATION 


While all that could be done to keep the timed 
trial between cohorts equal, one major difference 
existed. Students in the campus cohort 
performed their timed trial individually, while 
participants in the workshop cohort performed 
their timed trial as a group. If this study were 
to be replicated, both groups would be made 
equal in this area. The recommendation would 
be for both cohorts to complete the trials as a 
group. This method appeared to give the better 
results as it both promoted competition and 
reduced frustration. 


As a method of maintaining anonymity, 
times for each task were self-reported. Were this 
study to be repeated, it is recommended that a 
third-party observer record the times of 
completion, thereby standardizing the 
measurement. It is recognized that with self- 
reporting each participant defines the start 
point and the end point of the activity. With a 
single third-party recorder, the start point and 
end point would be similar across the board. 


Further investigation planned for this topic 
of study includes long-term effects of the chip- 
off training. Are participants who complete the 
forty-hour chip-off training workshop able to 
effectively use the chip-off processes in their 
workplace? A with students 
graduating with an emphasis in digital forensics 
is also planned. Does post-employment of these 


follow-up 


students involve careers in the digital forensics 
field? Do their credits in digital forensics help 
them obtain employment? Does their knowledge 
and skill in chip-off forensics make them 
competitive in the job market? These are 
questions that will fuel future research 
investigation. 


© 2017 ADFSL 
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